Linux Operating System Source Code: IBM Patches

Back in April 2000, there was some discussion about the race condition where a call to zap_page_range followed by a call to flush_tlb_range allows for a page which has been freed to be re-allocated on a different cpu and referenced via a tlb on a third cpu before the tlb is actually flushed.

Below is a patch which removes the race condition by moving the call to flush_tlb_range inside of zap_page_range (actually inside of zap_pte_range). For performance reasons the single loop which removed the entry from the pte then freed the page was changed to 2 loops so that we don't have to flush the tlb on every page.

Comments are welcome on the Linux kernel mailing list.